Re: [ANNOUNCE] Git 2.56.1 and friends

[Toon Claes]

>>>   * CVE-2026-113408:
>>>
>>>     It is possible for a server to advertise an unborn HEAD that contains
>>>     path-traversal characters (e.g., `refs/heads/../../../TARGET`). With
>>>     the files ref backend that can lead to ref-updating actions to write
>>>     to unwanted files.
>>>
>>>     See <https://gitlab.com/gitlab-org/git/-/work_items/809> for details.
>> 
>> FWIW, this and the other GitLab work item links appear to be
>> inaccessible to normal users.  I'm guessing that's not the
>> intent.
>> 
>> I added Patrick to the Cc as one of the folks who may be
>> able to poke the right folks at GitLab to open them up?
>> 
>
> Thank you for pointing it out. It was indeed not the intention. Those 
> work items are accessible now.

Yeah, I was planning to open them up ASAP, but I wasn't around my
computer around the time this release came out. I did open them around
midnight CET. Thanks for pointing that out.

-- 
Laters,
Toon